To be fair npm makes (made?) it weirdly hard to use lock files so a lot of people did that by mistake. And when you do use lock, it reinstalls every time so a retagged package can just silently update.
replydoesn't `npm ci` prevent that? it fails if something doesn't match the lockfile, and wipes node_modules before running
replythis is on some ancient node 16 build i was trying to clean up ci for, so not very recent npm
deleted
replyFYI a retagged package would result in a different SHA512 integrity sum and fail the installation process. It won't "just silently update".
replyAnyway, the point of parent and me wasn't that it was considered to be a "mistake", but people thinking they "are doing the right thing".
I can’t comment on the behavior of ancient npm versions, but with modern npm I would not even know how to skip using a lockfile.
replyAs for the parent comment about not using the lockfile for the production build, that’s just incredibly incompetent.
Maybe they should hire someone who knows what they are doing. Contrary to the popular beliefs of backend engineers online, you also need some competency to do frontend properly.
In this case what’s needed is „npm ci“ instead of „npm install“ or better „pnpm install —frozen-lockfile“.
Pnpm will also do that automatically if the CI environment variable is set.